DEPARTMENT OF DEFENSE UNITED STATES CYBER COMMAND 9800 SAVAGE ROAD SUITE 6 171 FORT GEORGE G MEADE MARYLAND 20755 DEC 2 0 2018 Michael Martelle The National Security Archive Gelman Library Suite 701 2130 H Street N W Washington D C 20037 Dear Mr Martelle Thank you for your September 9 2018 Freedom of Information Act FOIA request for the briefing on operational strategy given by the Combined Action Group in October 2016 As the initial denial authority I am partially denying portions of the document under 5 U S C 552 b l and b 3 The denied portions include classified national security information under the criteria of Executive Order 13526 labeled as b 1 and personally identifying information regarding personnel assigned to a sensitive unit exempt from disclosure under 10 U S C 130b labeled as b 3 U S Cyber Command is a sensitive unit If you are not satisfied with our action on this request you may file an administrative appeal within 90 calendar days from the date of this letter by U S mail or email If you submit your appeal in writing please address it to ODCMO Director of Oversight and Compliance 4800 Mark Center Drive ATTN DPCLTD FOIA Appeals Mailbox #24 Alexandria VA 223501700 If you submit your appeal by email please send it to OSD FOIA-APPEAL@mail mil All correspondence should reference U S Cyber Command case tracking number 19-ROl l Additionally you may contact the Office of Government Information Services OG IS which provides mediation services to help resolve disputes between FOIA requesters and Federal agencies Contact information is 8601 Adelphi Road - OGIS College Park MD 20740-6001 OGIS may also be reached at ogis@nara gov 202-741-5770 and 1-877-684-6448 G A fflu f i ROSS A MYER 1 Rear Admiral Navy Chief of Staff How understanding cyberspace as a strategic environment should drive cyber capabilities and operations f b 3 Sec 13 ob ICombined Action Group us Cyber Command NSA The overall classification of this briefing is TOP S CRET SI NOFORN kH 3 Classified By l j Derived From USCYB RCOIVI SCG I Dated 20111011 AND Derived From NSA CSSM 1-52 Dated 20130930 Declassify On 20411128 Unclassified 2 26 2013 11 10 AM VERSION X J-Code AO 1 Unclassified U Strategic ca abilitYt effectz environment o o U Strate ic ca abilit effect impact on the systemic 1str1 ut1on o power either regionally or globally o U Nuclear -weapons because of their immediate systemic impactf collapsed the difference between capabi ity and effect o U Nuclear Strategic but that is not the case in traditional conventional or cyber environments o U Strategic environments dominant technology creates a structure that reinforces core conditions and fundamental dynamics Unclassified 2 26 2013 11 10 AM VERSION X J-Code AO 2 Unclassified o U BLUF Nuclear v Cyber Thinking o U Misalignment between policy and the strategic environment actually has a strategic impact o U We are self-constraining through a focus on cyber deterrence as the strategic frame o U This has cleared space for increased adversarial maneuver and capability development in support of strategies of cyber persistence o U We need to adopt the process of nuclear thinking not the output of that thinking Nuclear thinking is narrowing cyber capabilities' relevancy Unclassified 2 26 2013 11 10 AM VERSION X J-Code AO 3 UNCLASSIFIED U The lncontestable Effect UNCLASSIFIED UNCLASSIFIED o Unclassified Nuclear Strategic Environment Technological Imperative Pure offense dominance Core Condition Assured destruction Mutual possession of second strike capability Intervening Variable s Dominant strategic dynamic Deterrence Locus of action Initiative is relinquished to the other side Security rests In the decision calculus of the adversary Core strategic question How do I secure when I cannot defend Measure of Effectiveness Absence of specified adversarial action Decision-making model Crisis management Centralized one big decision one time Time is condensed Leaving the last clear chance to avoid catastrophe to the adversary Escalation dynamics National interests advanced through deescalated outcome Hold at risk strategic exotic expensive one-off 0 Nuclear strategic contest UNCLASSIFIED Dynamically Constructed Cyber terrain UNCLASSIFIED UNCLASSIFIED Constant Contact Lu In 2 UNCLASSIFIED UNCLASSIFIED The INTERCONNECTED Threat Opportunity Environment o Unclassified UNCLASSIFIED Cyber Strategic Environment Technological Imperative Interconnected Core Condition Constant Contact Dynamically constructed terrain Intervening Variable s Dominant st rategic dynamic Persistence Locus of action Initiative must be seized and retained Security rests In the effective grappling over cyber initiative Core strategic question How do I secure when I am in constant contact with the adversary ally business sector and individuals all of whom are operationally persistent M easure of Effectiveness Anticipation of the exploitation of cyber-related vulnerabilities Decision-making mod el Constant Conditional from the edge up Crisis management Time is crushed Cyber compellence at phase O cross domain reliant Escalation dynamics National interests advanced through winning or supporting deescalation outcome Adaptive to stay out in front of exploiting vulnerabilities full spectrum from resiliency defense active defense offense tactical operational and strategic UNCLASSIFIED U The Technology is adaptive and iterative the Terrain is constantly shifting U Operational Persistence is a systemic condition of continuous willingness and capacity to seek the initiative U The terrain of cyberspace encourages persistence and the technology allows it UNCLASSIFIED U Thinking Differently to Organize Plan Operate Differently Persistence is the 180 degree opposite of deterrence Seize the cyber initiative through maneuver with in our own systems in neutral systems and into adversary systems with operations that deny nodes to actors as terrain to be used while we use those same nodes ourselves to deliver effects UNCLASSIFIED UNCLASSIFIED o U Cyber Initiative defined o U the technical tactical and operational outcome of effective anticipation of the exploitation of cyber-related vulnerabilities o U The anticipation enables both the prevention of exploitation by adversaries and the leveraging of exploitation by the United States - U Tactically and operationally denying disrupting seizing and retaining the cyber initiative includes the full range of activities included in cyber resiliency defense active defense CNE offense UNCLASSIFIED UNCLASSIFIED o U Cyberspace superiority o U the sustained technical tactical and operational outcome of effective anticipation of the exploitation of cyber-related vulnerabilities across the interconnected domain of cyberspace that permits the secure reliable conduct of operations at a given time and place without prohibitive interference by an adversary revising JP 1-02 language o U Cyberspace superiority is sustained cyber initiative UNCLASSIFIED Tl ' n o rrnrTI I o U Deterrence and c ber o erations o S REL TO USA FVEY The proposed operational concept employs planning principles based on strategic deterrence and escalation control Strategy through development Offb 1 Sec 1 4 a rb 1 Sec 1 4 a fb 1 Sec 1 4 a jthat readily Support strategic deterrence and escalation control and which can synchronize with WOG strategic deterrence and escalation control efforts USCYBERCOM will develop and integrate fb 1 Sec 1 4 a b 1 Sec 1 4 a b 1 Sec 1 4 a to impose costs deny oenefits demonstrate resiliency and encourage adversary restraint - TS NF USCYBERCOM COMMANDER'S ESTIMATE CYBER MISSION FORCE CMF BALANCING STRATEGY AND STRATEGIC DETERRENCE AND ESCALATION CONTROL FRAMEWORK TS NF 22 Oct 2015 2 26 2013 11 10 AM VERSION X J-Code AO 16 UNCLASSIFIED U Russian strategic use of cyber capabilities o o U Overall objective shift the systemic distribution of balance by undermining faith in domestic democratic and European-wide institutions o U Cyber-enabled social media manipulation Cyber-amplification o U Cyber attacks on legitimacy of elites and electoral processes German Parliament CDU DNC Clinton Campaign Ukraine election Commission o U Firehose of Falsehood model high-volume multichannel rapid continuous repetitive agile targeted 1 o U What is U S strategic counter-capability UNCLASSIFIED 2 26 2013 11 10 AM VERSION X J-Code AO 17 UNCLASSIFIED o U China Sinosphere o U Supports both larger PRC goals of economic development and information control 1 o U Strategic goal to erode U S advantage in cyberspace U Harness the PRC cyber community- world's largest 647 million - as throw weight in demanding foreign businesses operating in PRC comply with laws regulations U Build and support PRC technology firms U Construct operate information networks in developing world U Promote PRC concepts of cyber governance and cyber security in international organizations - U Leverage position as world's largest manufacturer of lnformationtomputerTechnology ICT equipment to shape global engineering and design standarcfs while marketing its indigenous systems UNCLASSIFIED 2 26 2013 11 10 AM VERSION DRAFT J-o kb 3 1 1 1 _L_ __ 18 o U Post 2015 September Agreement Activity o TSffSl fREL J T Tl r b 1 Sec 1 4 a b 1 Sec 1 4 a Ch inese cyberactors r 1 Sec 1 4 o1 b 1 Sec 1 4 a 2 26 2013 11 10 AM VERSION DRAFT J-ofb 3 11 I I I 19 n o U rr -nr-rl Ir I I 11 r l ft o Post 2015 September Agreement Acti ity o TS 51 NF FISA In particular Chinese cyber b 1 Sec 1 4 a - Comment If the Chinese 1 1 r b Sec 4 a b 1 Sec 1 4 a 2 26 2013 11 10 AM VERSION DRAFT J o kb 3 I IC f l _ _ _ _ L_ _ 20 Unclassified o U Strategies of C ber Persistence o U Revisionist states understand that Cyber capabilities and operations can effect the systemic distribution of power o U They are engaged in a broad integrated appli ation of cyber capabilities to undermine American power o U How can the U S leverage cyber as a counterstrategic capability 7 It must broaden its application and framing beyond a deterrence-centric narrow box and embrace interconnectedness master constant contact and persist in sustaining the cyber initiative Unclassified 2 26 2013 11 10 AM VERSION X J-Code AO 21 Unclassified U Starkly Different Strategic Environments Nuclear Strategic Environment Cyber Strategic Environment Technological Imperative Pure offense dominance Interconnected Core Condit ion Assured destruction Mutual possession of second strike capability Constant Contact Dynamically Constructed terrain Dominant strategic d ynamic Deterrence Persistence Locus of action Initiative is relinquished to the other side Initiative must be seized and retained Security rests In the decision calculus of the adversary In the effective grappling over cyber initiative Co re strategic quest ion How do I secure when I cannot defend How do I secure when I am in constant contact with the adversary ally business sector and individuals all of whom are operationally persistent M easure of Effect iveness Absence of specified adversarial action Decision-making model Centralized one big decision one time Time is condensed Leaving the last clear chance to avoid catastrophe to the adversary National interests advanced through deescalated outcome Hold at risk strategic exotic expensive oneoff Anticipation of the exploitation of cyber-related vulnerabilities Constant Conditional from the edge up Time is crushed Cyber compellence at phase O cross domain reliant Unclassified Intervening Variable s I Crisis management Escalat ion dynamics National interests advanced through winning or supporting deescalation outcome Adaptive to stay out in front of exploiting vulnerabilities full spectrum from resiliency defense active defense offense tactical operational and strategic This document is from the holdings of The National Security Archive Suite 701 Gelman Library The George Washington University 2130 H Street NW Washington D C 20037 Phone 202 994-7000 Fax 202 994-7005 nsarchiv@gwu edu